# Dryx EdDSA Public Key (placeholder — generated in F2)
#
# The corresponding private key is held offline (Keychain in F1 interim;
# YubiHSM 2 in F2 final) and used to sign every Dryx release manifest.
#
# This public key is also compiled into the Dryx binary as DRYX_RELEASE_PUBKEY.
# The two MUST match. Mismatch indicates a compromise of either the build
# pipeline or the published release channel.
#
# Format: base64-encoded Ed25519 public key (32 bytes raw).
#
# Generated:    <ISO8601 timestamp, F2>
# Algorithm:    Ed25519 (EdDSA over Curve25519)
# Storage:      YubiHSM 2 (post-F2) — private key never leaves hardware
# Rotation:     every 24 months OR on suspicion of compromise
#
# --- Public key on the line below this header ---

PLACEHOLDER_FILL_IN_F2